CVE-2026-33037

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33037", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-17T18:10:50.210Z", "datePublished": "2026-03-20T05:25:49.049Z", "dateUpdated": "2026-03-24T01:51:03.827Z"}, "containers": {"cna": {"title": "WWBN AVideo has predictable default admin credentials in official Docker deployment path", "problemTypes": [{"descriptions": [{"cweId": "CWE-1188", "lang": "en", "description": "CWE-1188: Insecure Default Initialization of Resource", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-89rv-p523-6wg9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-89rv-p523-6wg9"}, {"name": "https://github.com/WWBN/AVideo/commit/2075fac1a51f21fab5d8592235a095aa354a9de6", "tags": ["x_refsource_MISC"], "url": "https://github.com/WWBN/AVideo/commit/2075fac1a51f21fab5d8592235a095aa354a9de6"}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"version": "< 26.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T05:25:49.049Z"}, "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 25.0 and below, the official Docker deployment files (docker-compose.yml, env.example) ship with the admin password set to \"password\", which is automatically used to seed the admin account during installation, meaning any instance deployed without overriding SYSTEM_ADMIN_PASSWORD is immediately vulnerable to trivial administrative takeover. No compensating controls exist: there is no forced password change on first login, no complexity validation, no default-password detection, and the password is hashed with weak MD5. Full admin access enables user data exposure, content manipulation, and potential remote code execution via file uploads and plugin management. The same insecure-default pattern extends to database credentials (avideo/avideo), compounding the risk. Exploitation depends on operators failing to change the default, a condition likely met in quick-start, demo, and automated deployments. This issue has been fixed in version 26.0."}], "source": {"advisory": "GHSA-89rv-p523-6wg9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T01:50:27.954903Z", "id": "CVE-2026-33037", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T01:51:03.827Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33037", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-24T01:50:27.954903Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T01:50:59.503Z"}}], "cna": {"title": "WWBN AVideo has predictable default admin credentials in official Docker deployment path", "source": {"advisory": "GHSA-89rv-p523-6wg9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"status": "affected", "version": "< 26.0"}]}], "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-89rv-p523-6wg9", "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-89rv-p523-6wg9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/WWBN/AVideo/commit/2075fac1a51f21fab5d8592235a095aa354a9de6", "name": "https://github.com/WWBN/AVideo/commit/2075fac1a51f21fab5d8592235a095aa354a9de6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 25.0 and below, the official Docker deployment files (docker-compose.yml, env.example) ship with the admin password set to \"password\", which is automatically used to seed the admin account during installation, meaning any instance deployed without overriding SYSTEM_ADMIN_PASSWORD is immediately vulnerable to trivial administrative takeover. No compensating controls exist: there is no forced password change on first login, no complexity validation, no default-password detection, and the password is hashed with weak MD5. Full admin access enables user data exposure, content manipulation, and potential remote code execution via file uploads and plugin management. The same insecure-default pattern extends to database credentials (avideo/avideo), compounding the risk. Exploitation depends on operators failing to change the default, a condition likely met in quick-start, demo, and automated deployments. This issue has been fixed in version 26.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1188", "description": "CWE-1188: Insecure Default Initialization of Resource"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T05:25:49.049Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33037", "state": "PUBLISHED", "dateUpdated": "2026-03-24T01:51:03.827Z", "dateReserved": "2026-03-17T18:10:50.210Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-20T05:25:49.049Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "AVideo", "vendor": "WWBN", "versions": [{"status": "affected", "version": "< 26.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "matchCriteriaId": "B468F0CE-E5E7-4607-BD15-B5763C47493E", "versionEndExcluding": "26.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 25.0 and below, the official Docker deployment files (docker-compose.yml, env.example) ship with the admin password set to \"password\", which is automatically used to seed the admin account during installation, meaning any instance deployed without overriding SYSTEM_ADMIN_PASSWORD is immediately vulnerable to trivial administrative takeover. No compensating controls exist: there is no forced password change on first login, no complexity validation, no default-password detection, and the password is hashed with weak MD5. Full admin access enables user data exposure, content manipulation, and potential remote code execution via file uploads and plugin management. The same insecure-default pattern extends to database credentials (avideo/avideo), compounding the risk. Exploitation depends on operators failing to change the default, a condition likely met in quick-start, demo, and automated deployments. This issue has been fixed in version 26.0."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En las versiones 25.0 e inferiores, los archivos oficiales de despliegue de Docker (docker-compose.yml, env.example) se distribuyen con la contrase\u00f1a de administrador establecida como 'password', que se utiliza autom\u00e1ticamente para inicializar la cuenta de administrador durante la instalaci\u00f3n, lo que significa que cualquier instancia desplegada sin sobrescribir SYSTEM_ADMIN_PASSWORD es inmediatamente vulnerable a una toma de control administrativa trivial. No existen controles compensatorios: no hay cambio de contrase\u00f1a forzado en el primer inicio de sesi\u00f3n, no hay validaci\u00f3n de complejidad, no hay detecci\u00f3n de contrase\u00f1a por defecto, y la contrase\u00f1a se hashea con un MD5 d\u00e9bil. El acceso completo de administrador permite la exposici\u00f3n de datos de usuario, la manipulaci\u00f3n de contenido y la potencial ejecuci\u00f3n remota de c\u00f3digo a trav\u00e9s de la carga de archivos y la gesti\u00f3n de plugins. El mismo patr\u00f3n de valores predeterminados inseguros se extiende a las credenciales de la base de datos (avideo/avideo), lo que agrava el riesgo. La explotaci\u00f3n depende de que los operadores no cambien el valor predeterminado, una condici\u00f3n que probablemente se cumpla en despliegues de inicio r\u00e1pido, demostraciones y automatizados. Este problema ha sido solucionado en la versi\u00f3n 26.0."}], "id": "CVE-2026-33037", "lastModified": "2026-06-17T10:36:50.840", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33037", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T01:50:27.954903Z", "version": "2.0.3"}}]}, "published": "2026-03-20T06:16:11.817", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/WWBN/AVideo/commit/2075fac1a51f21fab5d8592235a095aa354a9de6"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-89rv-p523-6wg9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1188"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "AVideo", "source": "cna", "vendor": "WWBN"}, "product": "avideo", "vendor": "wwbn"}], "analysis": {"en": {"generated_at": "2026-03-23T17:53:52.729913+00:00", "value": {"mitigation_remediation": ["Upgrade WWBN AVideo to version 26.0 or newer, where the default password issue is fixed. ", "If upgrading is not immediately possible, set a strong password in the SYSTEM_ADMIN_PASSWORD environment variable before starting the container. ", "Change the database credentials by configuring DATABASE_USER and DATABASE_PASSWORD to non\u2011default values. ", "Limit external access to the web interface with firewall rules or reverse\u2011proxy authentication to reduce the attack surface."], "summary": {"action": "Immediate patch", "impact": "Full administrative takeover, data exposure, and potential remote code execution"}, "threat_synthesis": {"affected_systems": "The affected application is WWBN AVideo up to and including version 25.0. The default Docker configuration files (docker-compose.yml and env.example) contain the hard\u2011coded credentials. No other versions prior to 26.0 are known to contain this issue.", "description_and_impact": "The vulnerability stems from the Docker deployment artifacts that ship the administrator password as \"password\" and assign database credentials of avideo/avideo. The default credentials are automatically used to seed the admin account during installation, providing an obvious, trivial entry point for attackers. The weakness is a predictable default password (CWE\u20111188) compounded by weak MD5 hashing, with no requirement for a password change on first login or any complexity enforcement. As a result, anyone who can reach the web interface of a newly deployed instance can obtain full administrative privileges, expose user data, modify content, and potentially execute code through file uploads or plugin management.", "risk_and_exploitability": "The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% suggests a low probability of exploitation, yet the impact if exploited is substantial. Attackers can log in simply by using the default credentials exposed in the container environment; no additional techniques are required. The lack of compensating controls and the availability of direct administrative access make the risk significant enough to warrant immediate remediation."}}}}, "created": "2026-03-20T08:52:28.533750+00:00", "updated": "2026-03-25T14:30:24.205135+00:00", "vendors": ["wwbn", "wwbn$PRODUCT$avideo"]}